{"record":{"id":"6c3a04182a0da5bf","repo":"git-ecosystem/git-credential-manager","slug":"errorsecinvalidkeychain","errorCode":"ErrorSecInvalidKeychain","errorMessage":"The keychain is not valid.","messagePattern":"The keychain is not valid\\.","errorType":"error_code","errorClass":"InteropException","httpStatus":null,"severity":"error","filePath":"src/Core/Interop/MacOS/Native/SecurityFramework.cs","lineNumber":144,"sourceCode":"        public const int ErrorSecNoSuchKeychain = -25294;\n        public const int ErrorSecInvalidKeychain = -25295;\n        public const int ErrorSecAuthFailed = -25293;\n        public const int ErrorSecDuplicateItem = -25299;\n        public const int ErrorSecItemNotFound = -25300;\n        public const int ErrorSecInteractionNotAllowed = -25308;\n        public const int ErrorSecInteractionRequired = -25315;\n        public const int ErrorSecNoSuchAttr = -25303;\n\n        public static void ThrowIfError(int error, string defaultErrorMessage = \"Unknown error.\")\n        {\n            switch (error)\n            {\n                case OK:\n                    return;\n                case ErrorSecNoSuchKeychain:\n                    throw new InteropException(\"The keychain does not exist.\", error);\n                case ErrorSecInvalidKeychain:\n                    throw new InteropException(\"The keychain is not valid.\", error);\n                case ErrorSecAuthFailed:\n                    throw new InteropException(\"Authorization/Authentication failed.\", error);\n                case ErrorSecDuplicateItem:\n                    throw new InteropException(\"The item already exists.\", error);\n                case ErrorSecItemNotFound:\n                    throw new InteropException(\"The item cannot be found.\", error);\n                case ErrorSecInteractionNotAllowed:\n                    throw new InteropException(\"Interaction with the Security Server is not allowed.\", error);\n                case ErrorSecInteractionRequired:\n                    throw new InteropException(\"User interaction is required.\", error);\n                case ErrorSecNoSuchAttr:\n                    throw new InteropException(\"The attribute does not exist.\", error);\n                default:\n                    throw new InteropException(defaultErrorMessage, error);\n            }\n        }\n    }\n","sourceCodeStart":126,"sourceCodeEnd":162,"githubUrl":"https://github.com/git-ecosystem/git-credential-manager/blob/e8ce762cd04b4100ae637b5fbf39ef9d0a96561e/src/Core/Interop/MacOS/Native/SecurityFramework.cs#L126-L162","documentation":"Thrown by SecurityFramework.ThrowIfError when a Security.framework call returns errSecInvalidKeychain (-25295): the keychain reference or path is not a valid keychain. Unlike -25294 (keychain absent), this means the keychain object exists but is malformed, corrupted, wrong format, or unusable by the Security framework. The library converts the OS status into a descriptive InteropException.","triggerScenarios":"Any MacOSKeychain operation whose underlying SecKeychain* call fails with OS status -25295 and is passed to ThrowIfError — e.g. finding, adding, updating, or deleting generic passwords against a keychain that the framework considers invalid.","commonSituations":"Corrupted login.keychain-db after disk issues or interrupted writes, keychain files created/copied from another macOS version or user, a path pointing to a non-keychain file, or older keychain formats after macOS upgrades.","solutions":["Repair the keychain: open Keychain Access and run Keychain First Aid, or `security verify-keychain` / recreate the keychain and re-import items","Confirm the default keychain is the correct file: `security default-keychain` and point it back to ~/Library/Keychains/login.keychain-db","Restore the keychain from Time Machine backup or re-create it (`security create-keychain`) and let apps re-store credentials","Log out/in after recreating the keychain so the securityd session picks up the new default keychain"],"exampleFix":"// before\n# keychain corrupted -> errSecInvalidKeychain\nsecurity default-keychain ~/Library/Keychains/old-broken.keychain\n// after\nsecurity create-keychain -p \"\" ~/Library/Keychains/login.keychain-db\nsecurity default-keychain ~/Library/Keychains/login.keychain-db\nsecurity unlock-keychain ~/Library/Keychains/login.keychain-db","handlingStrategy":"try-catch","validationCode":"using System;\nusing System.Diagnostics;\n\nstatic bool KeychainIsValid(string keychainPath)\n{\n    var psi = new ProcessStartInfo(\"security\", $\"verify-keychain {keychainPath}\")\n    {\n        UseShellExecute = false\n    };\n    using var p = Process.Start(psi);\n    p.WaitForExit();\n    return p.ExitCode == 0;\n}\n\nif (!KeychainIsValid(\"~/Library/Keychains/login.keychain-db\"))\n{\n    // repair/recreate the keychain before performing keychain operations\n}","typeGuard":null,"tryCatchPattern":"try\n{\n    keychain.Get(service, account);\n}\ncatch (InteropException ex) when (ex.ErrorCode == -25295) // errSecInvalidKeychain\n{\n    // Keychain corrupt/invalid: repair or recreate, then retry or fall back\n}\n","preventionTips":["Run `security verify-keychain` on keychain files restored or copied between machines","Recreate the keychain rather than using a repaired-but-suspicious file when corruption is detected","Don't copy keychain files across users or macOS versions; re-import items instead","Catch error code -25295 and fall back to an alternate ICredentialStore until the keychain is repaired"],"tags":["macos","keychain","security-framework","interop","corruption"],"backgroundTag":"invalid-state-transition","analyzedSha":"e8ce762cd04b4100ae637b5fbf39ef9d0a96561e","analyzedAt":"2026-09-11T17:15:08.753Z","contentChangedAt":"2026-09-11T17:15:08.753Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}